S427 · Source reachability audit

#![allow(unexpected_cfgs)]

//! S427 source-reachability audit for S401 through S426.
//!
//! The terminal S426 software receipt is reconciled with the closed 113/113
//! direct-access inventory and the 26 separately implemented successor gates.
//! Any runtime or physical claim is rejected because neither has been observed
//! in a supported profile at this gate.

use crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s426_s210_completion_reconciliation::{
    G8lS426S210CompletionReconciliationError, G8lS426TerminalCompletionReceipt,
    S426_DIRECT_SCHEDULER_ACCESS_SITES, S426_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES,
    S426_SOURCE_AUDIT_UNITS, S426_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES,
    S426_UNROUTED_DIRECT_ACCESS_SITES,
};

pub const S427_SOURCE_AUDIT_UNITS: usize = S426_SOURCE_AUDIT_UNITS;
pub const S427_DIRECT_ACCESS_SITES: usize = S426_DIRECT_SCHEDULER_ACCESS_SITES;
pub const S427_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES: usize =
    S426_SOURCE_MODEL_COVERED_DIRECT_ACCESS_SITES;
pub const S427_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES: usize =
    S426_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES;
pub const S427_UNROUTED_DIRECT_ACCESS_SITES: usize = S426_UNROUTED_DIRECT_ACCESS_SITES;
pub const S427_FIRST_AUDITED_GATE: usize = 401;
pub const S427_LAST_AUDITED_GATE: usize = 426;
pub const S427_AUDITED_GATE_COUNT: usize = S427_LAST_AUDITED_GATE - S427_FIRST_AUDITED_GATE + 1;
pub const S427_AUDIT_SLOT_CAPACITY: usize = 1;
pub const S427_PRODUCTION_AUDIT_CALLSITES: usize = 1;
pub const S427_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS: usize = 0;
pub const S427_PHYSICAL_OBSERVATIONS: usize = 0;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct G8lS427SourceReachabilityAudit {
    pub attempt_id: u64,
    pub provider_request_id: u64,
    pub exclusive_token: u64,
    pub audited_gate_count: usize,
    pub main_software_lifecycle_complete: bool,
    pub all_direct_access_guarded: bool,
    pub runtime_observed: bool,
    pub physical_observed: bool,
}

#[derive(Debug)]
pub struct G8lS427SourceReachabilityAuditState {
    pending: Option<G8lS427SourceReachabilityAudit>,
}

impl G8lS427SourceReachabilityAuditState {
    pub const fn new() -> Self {
        Self { pending: None }
    }
    pub const fn pending(&self) -> bool {
        self.pending.is_some()
    }
    pub fn pending_audit(
        &self,
        caller_cpu: usize,
    ) -> Result<Option<G8lS427SourceReachabilityAudit>, G8lS427SourceReachabilityAuditError> {
        if caller_cpu != 1 {
            return Err(G8lS427SourceReachabilityAuditError::WrongCpu);
        }
        Ok(self.pending)
    }
    pub fn take(
        &mut self,
        caller_cpu: usize,
    ) -> Result<Option<G8lS427SourceReachabilityAudit>, G8lS427SourceReachabilityAuditError> {
        if caller_cpu != 1 {
            return Err(G8lS427SourceReachabilityAuditError::WrongCpu);
        }
        Ok(self.pending.take())
    }
}

impl Default for G8lS427SourceReachabilityAuditState {
    fn default() -> Self {
        Self::new()
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS427SourceReachabilityAuditError {
    WrongCpu,
    S426(G8lS426S210CompletionReconciliationError),
    TerminalBindingDrift,
    SlotOccupied,
    TerminalDisappeared,
    TerminalDrift,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum G8lS427SourceReachabilityAuditOutcome {
    Idle,
    AuditPublished(G8lS427SourceReachabilityAudit),
    AuditPending(G8lS427SourceReachabilityAudit),
}

pub fn service_s427_model_source_reachability_audit(
    state: &mut G8lS427SourceReachabilityAuditState,
    caller_cpu: usize,
    terminal: G8lS426TerminalCompletionReceipt,
) -> Result<G8lS427SourceReachabilityAuditOutcome, G8lS427SourceReachabilityAuditError> {
    if caller_cpu != 1 {
        return Err(G8lS427SourceReachabilityAuditError::WrongCpu);
    }
    if terminal.attempt_id == 0
        || terminal.provider_request_id == 0
        || terminal.exclusive_token == 0
        || !terminal.s212_reconciled
        || !terminal.s210_completed
        || !terminal.return_handoff_acknowledged
        || terminal.supported_profile_runtime_observed
        || terminal.physical_observed
        || S427_DIRECT_ACCESS_SITES != 113
        || S427_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES != S427_DIRECT_ACCESS_SITES
        || S427_UNROUTED_DIRECT_ACCESS_SITES != 0
    {
        return Err(G8lS427SourceReachabilityAuditError::TerminalBindingDrift);
    }
    let audit = G8lS427SourceReachabilityAudit {
        attempt_id: terminal.attempt_id,
        provider_request_id: terminal.provider_request_id,
        exclusive_token: terminal.exclusive_token,
        audited_gate_count: S427_AUDITED_GATE_COUNT,
        main_software_lifecycle_complete: true,
        all_direct_access_guarded: true,
        runtime_observed: false,
        physical_observed: false,
    };
    if let Some(existing) = state.pending {
        return if existing == audit {
            Ok(G8lS427SourceReachabilityAuditOutcome::AuditPending(
                existing,
            ))
        } else {
            Err(G8lS427SourceReachabilityAuditError::SlotOccupied)
        };
    }
    state.pending = Some(audit);
    Ok(G8lS427SourceReachabilityAuditOutcome::AuditPublished(audit))
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
static S427_PRODUCTION_AUDITS: spin::Mutex<G8lS427SourceReachabilityAuditState> =
    spin::Mutex::new(G8lS427SourceReachabilityAuditState::new());

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn service_s427_source_reachability_audit_on_cpu1(
) -> Result<G8lS427SourceReachabilityAuditOutcome, G8lS427SourceReachabilityAuditError> {
    use crate::g8l_runtime_contract::CPU1;
    if let Some(existing) = S427_PRODUCTION_AUDITS.lock().pending_audit(CPU1)? {
        return Ok(G8lS427SourceReachabilityAuditOutcome::AuditPending(
            existing,
        ));
    }
    let Some(terminal) = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s426_s210_completion_reconciliation::inspect_s426_terminal_completion_on_cpu1()
        .map_err(G8lS427SourceReachabilityAuditError::S426)? else {
        return Ok(G8lS427SourceReachabilityAuditOutcome::Idle);
    };
    let taken = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s426_s210_completion_reconciliation::take_s426_terminal_completion_on_cpu1()
        .map_err(G8lS427SourceReachabilityAuditError::S426)?
        .ok_or(G8lS427SourceReachabilityAuditError::TerminalDisappeared)?;
    if taken != terminal {
        return Err(G8lS427SourceReachabilityAuditError::TerminalDrift);
    }
    service_s427_model_source_reachability_audit(&mut S427_PRODUCTION_AUDITS.lock(), CPU1, taken)
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn inspect_s427_source_reachability_audit_on_cpu1(
) -> Result<Option<G8lS427SourceReachabilityAudit>, G8lS427SourceReachabilityAuditError> {
    S427_PRODUCTION_AUDITS.lock().pending_audit(1)
}

#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn take_s427_source_reachability_audit_on_cpu1(
) -> Result<Option<G8lS427SourceReachabilityAudit>, G8lS427SourceReachabilityAuditError> {
    S427_PRODUCTION_AUDITS.lock().take(1)
}

use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s426_s210_completion_reconciliation::G8lS426TerminalCompletionReceipt;
use aselsan_microkernel_simulation::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s427_source_reachability_audit::*;

fn terminal() -> G8lS426TerminalCompletionReceipt {
    G8lS426TerminalCompletionReceipt {
        attempt_id: 7,
        provider_request_id: 8,
        exclusive_token: 9,
        s212_reconciled: true,
        s210_completed: true,
        return_handoff_acknowledged: true,
        supported_profile_runtime_observed: false,
        physical_observed: false,
    }
}

#[test]
fn constants_reconcile_s401_through_s426_source_range() {
    assert_eq!(S427_FIRST_AUDITED_GATE, 401);
    assert_eq!(S427_LAST_AUDITED_GATE, 426);
    assert_eq!(S427_AUDITED_GATE_COUNT, 26);
    assert_eq!(S427_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S427_PRODUCTION_GUARDED_DIRECT_ACCESS_SITES, 113);
    assert_eq!(S427_SUPPORTED_PROFILE_RUNTIME_OBSERVATIONS, 0);
    assert_eq!(S427_PHYSICAL_OBSERVATIONS, 0);
}

#[test]
fn exact_terminal_receipt_publishes_source_audit() {
    let mut state = G8lS427SourceReachabilityAuditState::new();
    let outcome = service_s427_model_source_reachability_audit(&mut state, 1, terminal()).unwrap();
    let G8lS427SourceReachabilityAuditOutcome::AuditPublished(audit) = outcome else {
        panic!("audit")
    };
    assert_eq!(
        (
            audit.attempt_id,
            audit.provider_request_id,
            audit.exclusive_token
        ),
        (7, 8, 9)
    );
    assert_eq!(audit.audited_gate_count, 26);
    assert!(audit.main_software_lifecycle_complete && audit.all_direct_access_guarded);
    assert!(!audit.runtime_observed && !audit.physical_observed);
}

#[test]
fn runtime_or_physical_claim_drift_is_rejected() {
    let mut state = G8lS427SourceReachabilityAuditState::new();
    let mut drift = terminal();
    drift.supported_profile_runtime_observed = true;
    assert_eq!(
        service_s427_model_source_reachability_audit(&mut state, 1, drift),
        Err(G8lS427SourceReachabilityAuditError::TerminalBindingDrift)
    );
    let mut drift = terminal();
    drift.physical_observed = true;
    assert_eq!(
        service_s427_model_source_reachability_audit(&mut state, 1, drift),
        Err(G8lS427SourceReachabilityAuditError::TerminalBindingDrift)
    );
}

#[test]
fn exact_replay_is_pending_and_drift_backpressures() {
    let mut state = G8lS427SourceReachabilityAuditState::new();
    service_s427_model_source_reachability_audit(&mut state, 1, terminal()).unwrap();
    let audit = state.pending_audit(1).unwrap().unwrap();
    assert_eq!(
        service_s427_model_source_reachability_audit(&mut state, 1, terminal()),
        Ok(G8lS427SourceReachabilityAuditOutcome::AuditPending(audit))
    );
    let mut next = terminal();
    next.attempt_id = 70;
    assert_eq!(
        service_s427_model_source_reachability_audit(&mut state, 1, next),
        Err(G8lS427SourceReachabilityAuditError::SlotOccupied)
    );
}

#[test]
fn production_backpressures_before_taking_s426_terminal() {
    let source = include_str!("../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s427_source_reachability_audit.rs");
    let start = source
        .find("service_s427_source_reachability_audit_on_cpu1")
        .unwrap();
    let body = &source[start..];
    let pending = body.find("pending_audit(CPU1)").unwrap();
    let inspect = body
        .find("inspect_s426_terminal_completion_on_cpu1")
        .unwrap();
    let take = body.find("take_s426_terminal_completion_on_cpu1").unwrap();
    let publish = body
        .find("service_s427_model_source_reachability_audit")
        .unwrap();
    assert!(pending < inspect && inspect < take && take < publish);
}

#[test]
fn audit_state_take_is_one_shot() {
    let mut state = G8lS427SourceReachabilityAuditState::new();
    service_s427_model_source_reachability_audit(&mut state, 1, terminal()).unwrap();
    assert!(state.take(1).unwrap().is_some());
    assert!(state.take(1).unwrap().is_none());
}

#[test]
fn timer_runs_s427_after_s426_before_scheduler_dispatch() {
    let source = include_str!("../../kernel/src/arch/aarch64/exceptions.rs");
    let s426 = source
        .find("service_s426_s210_completion_reconciliation_on_cpu1")
        .unwrap();
    let s427 = source
        .find("service_s427_source_reachability_audit_on_cpu1")
        .unwrap();
    let scheduler = source.rfind("rpi5_g7d::on_timer_irq").unwrap();
    assert!(s426 < s427 && s427 < scheduler);
    let name = "g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s427_source_reachability_audit";
    assert!(include_str!("../../kernel/src/main.rs").contains(&format!("mod {name};")));
    assert!(include_str!("../src/lib.rs").contains(&format!("pub mod {name};")));
}

  {
    id: "g8l-s427-source-reachability-audit-partial",
    sequence: 427,
    slug: "source_reachability_audit",
    title: "Source reachability audit",
    focusedTests: 7,
    sourceBytes: 7410,
    sourceSha256:
      "58dcbbdf0b7ed8187611051c73754724ef54f53b5977bfc0343691fadbb5434a",
    testBytes: 5013,
    testSha256:
      "9d98b70516e2120e1243de1942fb73c71e3f839c315d44c47c6b9474bd37615a",
    acceptance:
      "S401–S426 arasındaki 26 ayrı kapı, timer/IRQ/CPU0/CPU1 callsite sırası ve 7/113/113/113/0 coverage zarfıyla source-reachable olarak denetlenir.",
    retainedBoundary:
      "Audit runtime veya fiziksel observation üretmez; full-chain state reconciliation S428'e ayrılır.",
  },